certifly_

Blog

Notes on building this: what compliance evidence actually has to prove, and the parts of an audit no configuration checker can see.